Site Navigation
WHOIS Privacy and GDPR: What Data Can You Still See?
Open a WHOIS record today and you will often see the word redacted where a name and address used to be. The change followed data protection rules that limit what registrars may publish about individuals. Researchers who understand what remains visible can still do most of their work.
Why WHOIS changed
WHOIS began as an open directory in which anyone could read the contact details of a domain's owner. The openness collided with privacy law once personal data became tightly regulated, especially in Europe. Registrars responded by hiding personal fields in public results.
A guide such as WHOIS lookup services compared by SEO.Domains covers the transition from WHOIS to RDAP and the effect of GDPR redaction on research. The practical effect is that tools now differ less in what they show and more in how they present it, because the underlying public data is the same.
The change did not remove the record. A domain still has a public entry with technical and administrative facts, and the redaction applies mainly to personal contact details. Researchers should therefore think of the shift as a change in how personal fields are presented, not as the end of public domain data.
Awareness grew as data protection rules took effect, and registrars needed a consistent approach. Many chose to redact by default for individuals, since the risk of publishing personal data by mistake outweighed the benefit of a fully open record.
What you can still see
ICANN's announcement of its RDAP based lookup tool states that due to applicable law and ICANN policies, results containing personal data associated with the queried domain name may be redacted for privacy. The key word is may, because not every record is redacted to the same degree.
Typically visible fields include the registrar, the creation, update and expiry dates, the nameservers and the status codes. Such fields answer questions about age, activity and lifecycle. Organization names sometimes remain visible, especially for businesses, where privacy law applies differently than for individuals.
Expect variation between extensions. Country code registries set their own rules, and some publish more or less than generic registries. Check the registry's policy before assuming that what you see in one extension applies to another.
Dates and statuses remain the most dependable fields for research. Treat names and addresses as bonuses when they appear, and never as data you can count on seeing for every domain.
Requesting nonpublic data
Some people have a legitimate reason to see hidden data. ICANN launched a free service in late 2023 to handle requests for nonpublic registration data for generic domains, connecting requesters with the participating registrars that hold the information. The service does not guarantee access.
The registrar decides whether to disclose, weighing the requester's stated interest against the privacy rights of the individual. Clear, specific, lawful reasons help, and vague curiosity does not. Expect a response that may be a refusal, a partial answer or a request for more detail.
For business purposes, a direct approach through public channels is usually quicker. A message to the website's published contact address often reaches the right person faster than a formal data request.
Prepare a request carefully if you decide to file one. State who you are, which domain you mean, what you need and why, and keep the reason specific and lawful. Attach supporting evidence, such as a trademark filing or an incident report, because registrars need grounds to justify disclosure.
Plan for delay. Registrars may take days or weeks to respond, and some do not participate in the service at all, in which case you must use their own abuse or legal contact channels. Treat the request as one option among several. Record the date you filed it.
Privacy services versus redaction
Two mechanisms can hide a registrant. Redaction is applied by the registrar under privacy law, and it replaces personal fields with a notice. A privacy or proxy service is a product that substitutes its own details for the registrant's, which many owners buy for extra protection.
From the outside, the two can look similar, and neither tells you much about the owner. A privacy service is not a sign of wrongdoing, since many legitimate individuals and businesses use one. Judge the domain by its content, history and behavior, not by whether its record is masked.
When you own domains, check your own settings. Confirm what your registrar shows publicly, and make sure the contact address used for renewal notices is still monitored.
Some owners enable privacy services for reasons of safety, such as home based businesses and individual creators. A masked record often reflects a sensible decision, not an attempt to hide.
A research workflow that respects privacy
Start with the facts that remain public. Record the registrar, dates, nameservers and statuses, and compare them with archive history and site content. Many research questions about a domain's age, activity and likely availability can be answered without any personal data.
When ownership matters, rely on public business information and direct contact. Respect the limits that privacy law sets, avoid tools that claim to unmask redacted records and keep a note of each source you used. A transparent method protects your conclusions and the people your research touches.
Keep a research log with the lookup source, the time and the fields you saw. If you later publish findings or share them with a client, the log shows how you reached them. Where a conclusion depends on data that might be outdated, say so plainly, and avoid presenting a masked record as proof that nothing is there. Review the log before any purchase decision.